Whether you use a window manager or not, you should lockdown X to prevent switching to virtual terminals, etc as explained in a link above.

Have that application do only what you want it to do and nothing else

If you don't use a window manager then popup windows won't work. If you want popups to work then you need to use a window manager and lock it down as well.

If you use MX or antiX then I also recommend using a live system such as a frugal install. Or you could boot a live-usb with the "toram" option and then unplug the live-usb and put it in your pocket. This ensures that the system will always boot into the same state even if someone breaks through the kiosk. For development, set things up on the live system with root persistence enabled and then when it is all ready, run live-remaster and disable root persistence when you have it set up the way you want. If you have a fast usb-3.0 stick then I recommend using static root persistence, not dynamic.

I don't need this locked down quite so tight as you're describing. All I need this for is to allow a handful of totally unsophisticated users to get to the payroll company's website and view and print their check stubs. The truth is, these people, while they're all good, salt of the earth, hard working folks, they're not competent enough to abuse the computer. My aim is to take away any need to make any choices. If I can present them with one button (and one button only) that gets them to the site, one button (and one button only) to print, and one button (and one button only) to exit, then I'm good. The mKiosk extension does what I need in Firefox; the rest was concerning MX itself.